Since early 2024, advanced persistent threat (APT) groups linked to Iran, North Korea, and China have exploited vulnerabilities in healthcare networks to deploy destructive malware, ransomware, and backdoors. These attacks aim to sabotage patient care systems, including diagnostic tools, laboratory automation, and life-support devices, while exfiltrating sensitive biomedical research data. The healthcare sector faces an unprecedented surge in cyberattacks from nation-state actors seeking to disrupt critical IT infrastructure and operational technology (OT) systems. In one campaign, attackers distributed trojanized DICOM viewer software-including spoofed Philips and Siemens applications-to deploy backdoors like ValleyRAT and Floxif. Healthcare institutions are advised to segment IT/OT networks, enforce multi-factor authentication for DICOM systems, and monitor for anomalous PowerShell activity. Silobreaker’s threat intelligence platform highlights ongoing campaigns exploiting CVE-2023-34362 (MOVEit) and Citrix vulnerabilities, underscoring the need for proactive patch management. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Threat actors increasingly pivot from IT to OT systems, exploiting legacy medical devices with hardcoded passwords or unpatched libraries. Silobreaker’s analysis of network traffic showed beaconing intervals of 300 seconds, mimicking legitimate DICOM data transfers to evade detection. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. A May 2025 advisory by ICS-CERT warned of memory corruption flaws in Pixmeo OsiriX MD (CVE-2025-XXXXX), which could allow attackers to crash systems or steal credentials. A February 2025 Forescout report revealed 29 malicious DICOM viewer samples designed to deploy ValleyRAT. For example, researchers demonstrated how attackers could inject fake tumors into CT scans by manipulating pixel data in DICOM files. As nation-state actors refine their tactics, integrating threat intelligence into incident response plans becomes a lifeline for patient safety. The 2024 ALPHV ransomware attack on Change Healthcare disrupted 100+ critical applications, delaying prescriptions for 190 million patients. Silobreaker analysts recently identified a spike in malware campaigns exploiting Digital Imaging and Communications in Medicine (DICOM) protocols, widely used for medical imaging. Researchers noted that the malware’s command-and-control (C2) infrastructure overlaps with known Chinese APT clusters, including Silver Fox and Panda Burning Incense. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 15 May 2025 08:39:52 +0000